The separation is enforced in the database, not in the interface. Every row of customer data carries its organisation, and the database applies row-level access rules so that a query only ever sees rows belonging to your own organisation.
This means the separation holds even if a fault were to occur in the application code — the query cannot reach another organisation's rows, because the restriction sits beneath the application.
Which organisation you belong to is derived from your sign-in and cannot be influenced from the browser.